Cisco WRVS4400N - Small Business Wireless-N Gigabit Security... Instruction Manual

Cisco Small Business
WRVS4400N Wireless-N Gigabit Security Router
with VPN
ADMINISTRATION
GUIDE

© 2009 Cisco Systems, Inc. All rights reserved. OL-20048-02
Cisco and the Cisco Logo are trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and other countries. A listing of Cisco's trademarks can be found
at www.cisco.com/go/trademarks. Third party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply
a partnership relationship between Cisco and any other company. (1005R)

Cisco WRVS4400N Wireless-N Gigabit Security Router with VPN Administration Guide 3
Contents
Chapter 1: Introduction 6
Chapter 2: Networking and Security Basics 8
An Introduction to LANs 8
The Use of IP Addresses 9
The Intrusion Prevention System (IPS) 11
Chapter 3: Planning Your Virtual Private Network (VPN) 13
Why do I need a VPN? 13
What is a VPN? 15
Chapter 4: Getting Started with the WRVS4400N Router 18
Front Panel 19
Back Panel 20
WRVS4400N Antennas 20
Placement Options 21
Installing the Router 24
Configuring the Router 26
Chapter 5: Setting Up and Configuring the WRVS4400N Wireless-N Router 28
Accessing the Web-Based Utility 29
Navigating the Utility 30
Setting Up Your Wireless-N Router 36
Configuring Wireless Settings 68
Configuring Firewall Settings 88
Configuring the ProtectLink Web Service 104
Configuring the VPN Settings 105
Configuring the QoS Settings 118
Configuring the Administration Settings 123
Configuring IPS Settings 135

Cisco WRVS4400N Wireless-N Gigabit Security Router with VPN Administration Guide 4
Contents
Configuring the L2 Switch Settings 141
Viewing Status 152
Chapter 6: Using the VPN Setup Wizard 160
VPN Setup Wizard 160
Before You Begin 160
Running the VPN Router Software Wizard 161
Appendix A: Troubleshooting 178
Frequently Asked Questions 191
Appendix B: Using Cisco QuickVPN for Windows 2000, XP, or Vista 195
Overview 195
Before You Begin 196
Installing the Cisco QuickVPN Software 197
Using the Cisco QuickVPN Software 199
Distributing Certificates to QuickVPN Users 202
Appendix C: Configuring a Gateway-to-Gateway IPSec Tunnel 203
Introduction 203
Environment 204
Configuring the VPN Settings for the VPN Routers 204
Configuring the Key Management Settings 206
Configuring PC 1 and PC 2 207
Appendix D: Finding Out MAC and IP Addresses 208
Windows 98 or Me Instructions 208
Windows 2000 or XP Instructions 209
For the Router’s Web-based Utility 209

Cisco WRVS4400N Wireless-N Gigabit Security Router with VPN Administration Guide 5
Contents
Appendix E: Cisco ProtectLink Web Service 210
Overview 210
How to Access the Web-Based Utility 210
How to Purchase, Register, or Activate the Service 211
How to Use the Service 214
Appendix F: Specifications 219
General 219
Performance 220
Management 220
Security 221
QoS 221
Layer 2 222
Environmental 222
Appendix G: Where to Go From Here 223

1
Cisco WRVS4400N Wireless-N Gigabit Security Router with VPN Administration Guide 6
Introduction
Thank you for choosing the Cisco WRVS4400N Wireless-N Gigabit Security
Router with VPN. The Wireless-N Gigabit Security Router with VPN is an advanced
Internet-sharing network solution for your small business needs. WRVS4400N lets
multiple computers in your office share an Internet connection through both wired
and wireless connections.
The WRVS4400N wireless router features a built-in 4-Port full-duplex 10/100/
1000 Ethernet switch, which allows you to connect four personal computers
directly, or you can connect more hubs and switches to create as big a network as
you need.
You can use the WRVS4400N wireless router as an intranet router to aggregate
traffic to a company backbone network.
The WRVS4400N wireless router has a built-in access point that supports the
latest 802.11n draft specification by IEEE. The WRVS4400N wireless router also
supports 802.11g and 802.11b clients in a mixed environment.
The built-in access point can support an 11n data rate of up to 300 Mbps. In
addition to having a higher data rate, 802.11n technology also promises longer
coverage by using multiple antennas to transmit and receive data streams in
different directions.
The Cisco WRVS4400N Wireless-N Gigabit Security Router with VPN is equipped
with advanced security technologies like Intrusion Prevention System (IPS),
Stateful Packet Inspection (SPI) Firewall, IP based Access List (IP ACL), and
Network Address Port Translation (NAPT, also called NAT as a more generic term).
These technologies work together by providing self-defensive strategy. They
identify, classify, and stop malicious attack traffic in real time while passing
through the WRVS4400N wireless router.
The SPI Firewall provides deep packet inspection to analyze packets in network
layer (IP) and transport layer (TCP, UDP) to block illegal packet transactions. You
can also use IP based ACL to limit traffic to a specific source, destination and
protocol.

Introduction
Cisco WRVS4400N Wireless-N Gigabit Security Router with VPN Administration Guide 7
1
NAPT allows you to open specific TCP/UDP port numbers to the Internet to
provide limited service while minimizing harmful traffic at the same time.
The Virtual Private Network (VPN) capability is another security feature that
creates encrypted “tunnels” through the Internet, allowing up to five remote offices
and five traveling users to securely connect into your office network from off-site.
Users connecting through a VPN tunnel are attached to your company’s network
with secure access to files, e-mail, and your intranet as if they were in the building.
You can also use the VPN capability to allow users on your small office network to
securely connect out to a corporate network.
The QoS features of the Cisco WRVS4400N Wireless-N Gigabit Security Router
with VPN provide consistent voice and video quality throughout your business.
This administration guide gives you all the information you need to connect, set up,
and configure your router.

2
Cisco WRVS4400N Wireless-N Gigabit Security Router with VPN Administration Guide 8
Networking and Security Basics
This chapter describes networking and security basics. It includes the following
sections:
•An Introduction to LANs, page 8
•The Use of IP Addresses, page 9
•The Intrusion Prevention System (IPS), page11
An Introduction to LANs
A router is a network device that connects two networks together.
The router connects your local area network (LAN), or the group of personal
computers in your home or office, to the Internet. The router processes and
regulates the data that travels between these two networks.
The router’s Network Address Translation (NAT) technology protects your network
of personal computers so users on the Internet cannot “see” your personal
computers. This is how your LAN remains private. The router protects your
network by inspecting the first packet coming in through the Internet port before
delivery to the final destination on one of the Ethernet ports. The router inspects
Internet port services like the web server, FTP server, or other Internet
applications, and, if allowed, it will forward the packet to the appropriate personal
computer on the LAN side.
You can use multiple Cisco WRVS4400N Wireless-N Gigabit Security Routers to
connect multiple LANs together. This usually applies to a medium-sized or larger
company where you want to divide your network into multiple IP subnets to
increase the intranet throughput and reduce the size of the IP broadcast domain
and its interference. In this case, you need one WRVS4400N wireless router for
each subnetwork and you can connect all the WAN ports to a second level router
or switch to the Internet.

Networking and Security Basics
The Use of IP Addresses
Cisco WRVS4400N Wireless-N Gigabit Security Router with VPN Administration Guide 9
2
The second level router only forwards data packets through a wired network so
you don’t have to use the Cisco WRVS4400N Wireless-N Gigabit Security Router.
You can use any wired router in the Cisco family such as RVS4000 that has 4 LAN
ports and 1 WAN port.
The Use of IP Addresses
IP stands for Internet Protocol. Every device in an IP-based network, including
personal computers, print servers, and routers, requires an IP address to identify
its location, or address, on the network. This applies to both the Internet and LAN
connections.
There are two ways of assigning IP addresses to your network devices.
A static IP address is a fixed IP address that you assign manually to a personal
computer or other device on the network. Since a static IP address remains valid
until you disable it, static IP addressing ensures that the device assigned it will
always have that same IP address until you change it. Static IP addresses are
commonly used with network devices such as server personal computers or print
servers.

Networking and Security Basics
The Use of IP Addresses
Cisco WRVS4400N Wireless-N Gigabit Security Router with VPN Administration Guide 10
2
If you use the router to share your cable or DSL Internet connection, contact your
ISP to find out if they have assigned a static IP address to your account. If so, you
will need that static IP address when configuring the router. You can get the
information from your ISP.
A dynamic IP address is automatically assigned to a device on the network. These
IP addresses are called dynamic because they are only temporarily assigned to
the personal computer or other device. After a certain time period, they expire and
may change. If a personal computer logs onto the network (or the Internet) and its
dynamic IP address has expired, the DHCP server will assign it a new dynamic IP
address.
A DHCP server can either be a designated personal computer on the network or
another network device, such as the router. By default, the router’s Internet
Connection Type is Obtain an IP automatically (DHCP).
The personal computer or network device obtaining an IP address is called the
DHCP client. DHCP frees you from having to assign IP addresses manually every
time a new user is added to your network.
For DSL users, many ISPs may require you to log on with a user name and
password to gain access to the Internet. This is a dedicated, high-speed
connection type called Point to Point Protocol over Ethernet (PPPoE). PPPoE is
similar to a dial-up connection, but PPPoE does not dial a phone number when
establishing a connection. It also will provide the router with a dynamic IP address
to establish a connection to the Internet.
By default, a DHCP server (on the LAN side) is enabled on the router. If you already
have a DHCP server running on your network, you MUST disable one of the two
DHCP servers. If you run more than one DHCP server on your network, you will
experience network errors, such as conflicting IP addresses. To disable DHCP on
the router, see Configuring Local Area Network (LAN) Settings, page 52
NOTE Since the router is a device that connects two networks, it needs two IP
addresses—one for the LAN, and one for the Internet. In this Administration
Guide, you’ll see references to the “Internet IP address” and the “LAN IP
address”.
Since the router uses NAT technology, the only IP address that can be seen
from the Internet for your network is the router’s Internet IP address.
However, even this Internet IP address can be blocked so the router and
network seem invisible to the Internet.

Networking and Security Basics
The Intrusion Prevention System (IPS)
Cisco WRVS4400N Wireless-N Gigabit Security Router with VPN Administration Guide 11
2
The Intrusion Prevention System (IPS)
IPS is an advanced technology to protect your network from malicious attacks. IPS
works together with your SPI Firewall, IP Based Access Control List (ACL),
Network Address Port Translation (NAPT), and Virtual Private Network (VPN) to
achieve the highest level of security. IPS works by providing real-time detection
and prevention as an in-line module in a router.
The WRVS4400N wireless router has hardware-based acceleration for real-time
pattern matching for detecting malicious attacks. It actively filters and drops
malicious TCP/UDP/ICMP/IGMP packets and can reset TCP connections. This
protects your client personal computers and servers running various operating
systems including Windows, Linux, and Solaris from network worm attacks.
However, this system does not prevent viruses contained in e-mail attachments.
The P2P (peer to peer) and IM (instant messaging) control allows you to prevent
network users from using those protocols to communicate with people over the
Internet. This helps the administrators to set up company policies on how to use
their Internet bandwidth wisely.
The signature file is the heart of the IPS system. It is similar to the virus definition
files on your personal computer’s Anti-Virus programs. IPS uses this file to match
against packets coming in to the Router and performs actions accordingly. As of
today, the Wireless-N Router is shipped with signature file version 1.3.8 and with a
total of 1101 rules. The rules cover the following categories: DDoS, Buffer
Overflow, Access Control, Scan, Trojan Horse, Misc., P2P, IM, Virus, Worm, and
Web Attacks.
It is recommended that you update your IPS signature file regularly to thwart new
attack types.
The following diagram illustrates a number of IPS scenarios.

Networking and Security Basics
The Intrusion Prevention System (IPS)
Cisco WRVS4400N Wireless-N Gigabit Security Router with VPN Administration Guide 12
2

3
Cisco WRVS4400N Wireless-N Gigabit Security Router with VPN Administration Guide 13
Planning Your Virtual Private Network (VPN)
This chapter provides information for planning your VPN and includes the
following sections:
•Why do I need a VPN?, page13
•What is a VPN?, page15
Why do I need a VPN?
Computer networking provides a flexibility not available when using an archaic,
paper-based system. With this flexibility, however, comes an increased risk in
security. This is why firewalls were first introduced. Firewalls help to protect data
inside of a local network. But what do you do once information is sent outside of
your local network, when e-mails are sent to their destination, or when you have to
connect to your company’s network when you are out on the road? How is your
data protected?
That is when a VPN can help. VPNs are called Virtual Private Networks because
they secure data moving outside of your network as if it were still within that
network.
When data is sent out across the Internet from your computer, it is always open to
attacks. You may already have a firewall, which will help protect data moving
around or held within your network from being corrupted or intercepted by entities
outside of your network, but once data moves outside of your network—when you
send data to someone via e-mail or communicate with an individual over the
Internet—the firewall will no longer protect that data.

Planning Your Virtual Private Network (VPN)
WhydoIneeda VPN?
Cisco WRVS4400N Wireless-N Gigabit Security Router with VPN Administration Guide 14
3
At this point, your data becomes open to hackers using a variety of methods to
steal not only the data you are transmitting but also your network login and
security data. Some of the most common methods are as follows:
•MAC Address Spoofing, page14
•Data Sniffing, page14
•Man in the Middle Attacks, page14
MAC Address Spoofing
Packets transmitted over a network, either your local network or the Internet, are
preceded by a packet header. These packet headers contain both the source and
destination information for that packet to transmit efficiently. A hacker can use this
information to spoof (or fake) a MAC address allowed on the network. With this
spoofed MAC address, the hacker can also intercept information meant for
another user.
Data Sniffing
Data “sniffing” is a method used by hackers to obtain network data as it travels
through unsecured networks, such as the Internet. Tools for just this kind of activity,
such as protocol analyzers and network diagnostic tools, are often built into
operating systems and allow the data to be viewed in clear text.
Man in the Middle Attacks
Once the hacker has either sniffed or spoofed enough information, he can now
perform a “man in the middle” attack. This attack is performed, when data is being
transmitted from one network to another, by rerouting the data to a new
destination. Even though the data is not received by its intended recipient, it
appears that way to the person sending the data.
These are only a few of the methods hackers use and they are always developing
more. Without the security of your VPN, your data is constantly open to such
attacks as it travels over the Internet. Data travelling over the Internet will often
pass through many different servers around the world before reaching its final
destination. That’s a long way to go for unsecured data and this is when a VPN
serves its purpose.

Planning Your Virtual Private Network (VPN)
What is a VPN?
Cisco WRVS4400N Wireless-N Gigabit Security Router with VPN Administration Guide 15
3
What is a VPN?
A VPN, or Virtual Private Network, is a connection between two endpoints—a VPN
router, for instance—in different networks that allows private data to be sent
securely over a shared or public network, such as the Internet. This establishes a
private network that can send data securely between these two locations or
networks.
This is done by creating a “tunnel”. A VPN tunnel connects the two PCs or
networks and allows data to be transmitted over the Internet as if it were still
within those networks. Not a literal tunnel, it is a connection secured by encrypting
the data sent between the two networks.
VPN was created as a cost-effective alternative to using a private, dedicated,
leased line for a private network. Using industry standard encryption and
authentication techniques—IPSec, short for IP Security—VPN creates a secure
connection that, in effect, operates as if you were directly connected to your local
network. VPN can be used to create secure networks linking a central office with
branch offices, telecommuters, and/or professionals on the road (travelers can
connect to a VPN router using any computer with the Cisco QuickVPN Client
software.)
There are two basic ways to create a VPN connection:
•VPN router to VPN router
•Computer (using the Cisco QuickVPN Client software) to VPN router
The VPN router creates a “tunnel” or channel between two endpoints, so that data
transmissions between them are secure. A computer with the Cisco QuickVPN
Client software can be one of the two endpoints (refer to Appendix B, “Using
Cisco QuickVPN for Windows 2000, XP, or Vista”). If you choose not to run the
VPN client software, any computer with the built-in IPSec Security Manager
(Microsoft 2000 and XP) allows the VPN router to create a VPN tunnel using IPSec
(refer to Appendix C, “Configuring a Gateway-to-Gateway IPSec Tunnel.”).
Other versions of Microsoft operating systems require additional, third-party VPN
client software applications that support IPSec to be installed.

Planning Your Virtual Private Network (VPN)
What is a VPN?
Cisco WRVS4400N Wireless-N Gigabit Security Router with VPN Administration Guide 16
3
VPN Router to VPN Router
An example of a VPN router-to-VPN router VPN would be as follows. At home, a
telecommuter uses his VPN router for his always-on Internet connection. His router
is configured with his office’s VPN settings. When he connects to his office’s router,
the two routers create a VPN tunnel, encrypting and decrypting data. As VPNs
utilize the Internet, distance is not a factor. Using the VPN, the telecommuter now
has a secure connection to the central office’s network, as if he were physically
connected. For more information, refer to Appendix C, “Configuring a Gateway-
to-Gateway IPSec Tunnel.”

Planning Your Virtual Private Network (VPN)
What is a VPN?
Cisco WRVS4400N Wireless-N Gigabit Security Router with VPN Administration Guide 17
3
Computer to VPN Router
The following is an example of a computer-to-VPN router VPN. In her hotel room, a
traveling businesswoman connects to her ISP. Her notebook computer has the
Cisco QuickVPN Client software, which is configured with her office’s IP address.
She accesses the Cisco QuickVPN Client software and connects to the VPN
router at the central office. As VPNs utilize the Internet, distance is not a factor.
Using the VPN, she now has a secure connection to the central office’s network, as
if she were physically connected.
For additional information and instructions about creating your own VPN, please
visit www.cisco.com. You can also refer to Appendix B, “Using Cisco QuickVPN
for Windows 2000, XP, or Vista”, and Appendix C, “Configuring a Gateway-to-
Gateway IPSec Tunnel.”

4
Cisco WRVS4400N Wireless-N Gigabit Security Router with VPN Administration Guide 18
Getting Started with the WRVS4400N Router
This chapter describes the physical features of the WRVS4400N router and
provides information for installing the router. The following sections are included:
•Front Panel, page19
•Back Panel, page 20
•WRVS4400N Antennas, page 20
•Placement Options, page 21
•Installing the Router, page 24
•Configuring the Router, page 26

Getting Started with the WRVS4400N Router
Front Panel
Cisco WRVS4400N Wireless-N Gigabit Security Router with VPN Administration Guide 19
4
Front Panel
The LEDs are located on the front panel of the router.
Front of Router
POWER LED—Lights up green to indicate the router is powered on. The LED
flashes when the router is running a diagnostic test.
DIAG LED—If this light is off, the system is ready. The Diag LED blinks red
during firmware upgrades.
IPS LED—The IPS LED lights up when the Intrusion Prevention System (IPS)
function is enabled. If the LED is off, then IPS functions are disabled. The IPS
LED flashes green when an external attack is detected. It flashes red when an
internal attack is detected.
Wireless LED—The WIRELESS LED lights up when the wireless module is
enabled. The LED is off when the wireless module is disabled. The WIRELESS
LED flashes green when the data is transmitting or receiving on the wireless
module.
Ethernet Port LEDs 1-4—For each LAN port, there are three LEDs. If a port
LED is continuously lit green, the router is connected to a device at the speed
indicated through the corresponding port (1, 2, 3, or 4). The LED flashes green
when a router is actively sending or receiving data on that port.
INTERNET LED—The Internet LED lights up green to indicate the line speed of
the device attached to the Internet port. If the router is connected to a cable or
DSL modem, typically the 100 LED will be the only LED lit up, indicating
100 Mbps. Flashing indicates activity.

Getting Started with the WRVS4400N Router
Back Panel
Cisco WRVS4400N Wireless-N Gigabit Security Router with VPN Administration Guide 20
4
Back Panel
The Ethernet ports, Internet port, Reset button, and Power port are on the back panel of
the router.
WRVS4400N Antennas
The router has three non-detachable 1.8dBi omni-directional antennas. The three
antennas have a base that can rotate 90 degrees when in the standing position.
The three antennas support 2X3 MIMO diversity in wireless-N mode.
RESET Button—The Reset button can be used in two ways:
•If the router is having problems connecting to the Internet, press
the Reset button for just a second with a paper clip or a pencil tip.
This is similar to pressing the reset button on your personal
computer to reboot it.
•If you are experiencing extreme problems with the router and
have tried all other troubleshooting measures, press and hold in
the Reset button for 10 seconds. This restores the factory
defaults and clears all of the router settings, such as port
forwarding or a new password.
INTERNET Port—Provides a WAN connection to a cable modem or DSL
modem.
ETHERNET Ports 1-4—Provide a LAN connection to network devices,
such as PCs, print servers, or additional switches.
POWER Port—Connects the router to power via the supplied AC power
adapter.